SecurityInnovation / PGPy

Pretty Good Privacy for Python
BSD 3-Clause "New" or "Revised" License
313 stars 98 forks source link

Armorable ascii_headers member should not be OrderedDict #431

Open dkg opened 1 year ago

dkg commented 1 year ago

It's possible for an ASCII-armored PGP object to have multiple armor headers with the same key name.

RFC4880 §6.2 says:

Care should be taken that the Armor Headers are short enough to survive transport. One way to do this is to repeat an Armor Header key multiple times with different values for each so that no one line is overly long.

For example, repeating the Comment: header isn't an unlikely occurrence.

However, because the Armorable class treats the headers as an OrderedDict, a repeated header will clobber previous versions of the same header.